Cursor rule

1# Code Review Standards
2 
3## Purpose
4 
5Code review ensures quality, security, and maintainability before code is merged. This rule defines when and how to conduct code reviews.
6 
7## When to Review
8 
9**MANDATORY review triggers:**
10 
11- After writing or modifying code
12- Before any commit to shared branches
13- When security-sensitive code is changed (auth, payments, user data)
14- When architectural changes are made
15- Before merging pull requests
16 
17**Pre-Review Requirements:**
18 
19Before requesting review, ensure:
20 
21- All automated checks (CI/CD) are passing
22- Merge conflicts are resolved
23- Branch is up to date with target branch
24 
25## Review Checklist
26 
27Before marking code complete:
28 
29- [ ] Code is readable and well-named
30- [ ] Functions are focused (<50 lines)
31- [ ] Files are cohesive (<800 lines)
32- [ ] No deep nesting (>4 levels)
33- [ ] Errors are handled explicitly
34- [ ] No hardcoded secrets or credentials
35- [ ] No console.log or debug statements
36- [ ] Tests exist for new functionality
37- [ ] Test coverage meets 80% minimum
38 
39## Security Review Triggers
40 
41**STOP and use security-reviewer agent when:**
42 
43- Authentication or authorization code
44- User input handling
45- Database queries
46- File system operations
47- External API calls
48- Cryptographic operations
49- Payment or financial code
50 
51## Review Severity Levels
52 
53| Level | Meaning | Action |
54|-------|---------|--------|
55| CRITICAL | Security vulnerability or data loss risk | **BLOCK** - Must fix before merge |
56| HIGH | Bug or significant quality issue | **WARN** - Should fix before merge |
57| MEDIUM | Maintainability concern | **INFO** - Consider fixing |
58| LOW | Style or minor suggestion | **NOTE** - Optional |
59 
60## Agent Usage
61 
62Use these agents for code review:
63 
64| Agent | Purpose |
65|-------|---------|
66| **code-reviewer** | General code quality, patterns, best practices |
67| **security-reviewer** | Security vulnerabilities, OWASP Top 10 |
68| **typescript-reviewer** | TypeScript/JavaScript specific issues |
69| **python-reviewer** | Python specific issues |
70| **go-reviewer** | Go specific issues |
71| **rust-reviewer** | Rust specific issues |
72 
73## Review Workflow
74 
75```
761. Run git diff to understand changes
772. Check security checklist first
783. Review code quality checklist
794. Run relevant tests
805. Verify coverage >= 80%
816. Use appropriate agent for detailed review
82```
83 
84## Common Issues to Catch
85 
86### Security
87 
88- Hardcoded credentials (API keys, passwords, tokens)
89- SQL injection (string concatenation in queries)
90- XSS vulnerabilities (unescaped user input)
91- Path traversal (unsanitized file paths)
92- CSRF protection missing
93- Authentication bypasses
94 
95### Code Quality
96 
97- Large functions (>50 lines) - split into smaller
98- Large files (>800 lines) - extract modules
99- Deep nesting (>4 levels) - use early returns
100- Missing error handling - handle explicitly
101- Mutation patterns - prefer immutable operations
102- Missing tests - add test coverage
103 
104### Performance
105 
106- N+1 queries - use JOINs or batching
107- Missing pagination - add LIMIT to queries
108- Unbounded queries - add constraints
109- Missing caching - cache expensive operations
110 
111## Approval Criteria
112 
113- **Approve**: No CRITICAL or HIGH issues
114- **Warning**: Only HIGH issues (merge with caution)
115- **Block**: CRITICAL issues found
116 
117## Integration with Other Rules
118 
119This rule works with:
120 
121- [testing.md](testing.md) - Test coverage requirements
122- [security.md](security.md) - Security checklist
123- [git-workflow.md](git-workflow.md) - Commit standards
124- [agents.md](agents.md) - Agent delegation
125